AI regulation: How the AI Act is changing the healthcare sector

Contents

From tumor-detecting software in radiology to digital therapy support, artificial intelligence opens up a wide range of possibilities for making medical devices more efficient and patient-oriented. But what are AI-based medical devices, and how are they classified in terms of risk? And what synergies arise between the AI Act and the Medical Device Regulation (MDR)?

What are AI-based medical devices?

AI-based medical devices are AI systems within the meaning of the AI Act that also meet the definition of a medical device under the MDR. An AI system within the meaning of the AI Act is a machine-supported, partially autonomous system that derives predictions, recommendations, or decisions from input data and can be adaptable, enabling it to influence physical or virtual environments. In nuce: autonomous and potentially adaptive software with the ability to infer. Medical devices within the meaning of the MDR are devices with a medical purpose that are intended by the manufacturer to be used on humans.

According to the MDR, (AI) software is considered a medical device if it interprets medical data, makes diagnoses, offers therapy suggestions or supports the medical decision-making process.

AI-based medical devices can be used in the following areas, for example

• Diagnostics (such as tumor detection in radiology)
• Therapy (e.g., digital treatment support)
• Surgery (such as surgical assistance)
• Monitoring and aftercare (e.g., telemedicine, chatbots)

Medical chatbots are also used in many areas of healthcare today. As symptom checkers, they can provide an initial assessment or remind patients to take their medication. However, not all chatbots used in the healthcare sector are AI-based medical devices. For example, chatbots that follow a decision tree according to an if-then logic are not AI, while AI chatbots that give general recommendations without an explicit medical purpose (such as wellness chatbots or calorie trackers) are not medical devices. The scope of application of both regulations must be examined separately.

Classification of AI-based medical devices according to the AI Act and MDR

If the scope of application of the MDR and the AI Act is opened, the AI medical device must be classified. The MDR must be checked first, as classification under the AI Act depends on whether a notified body must be involved in the conformity assessment.

Classification under the MDR is carried out in accordance with Art. 51 para. 1 MDR using the classification rules in Annex VIII. — AI medical devices are classified in the same way as “conventional” medical devices – into risk classes I, IIa, IIb or III according to their intended purpose, with class III being the highest risk category.

The relevant classification rule of the AI Act can be found in Art. 6 para. 1 AI Act. According to this, an AI system is considered a high-risk AI system,

• if it is either itself a product that falls under one of the European harmonization laws listed in Annex I of the AI Act, or
• it is a safety component of such a product, and
• the device in question must undergo a third-party conformity assessment before being placed on the market or put into service.

For medical devices in classes IIa, IIb, III as well as certain custom-made devices and devices with special functions (e.g., sterile devices), the involvement of a Notified Body is required. In other words, except for Class I medical devices and custom-made devices, the conformity assessment procedure requires the involvement of a “Notified Body”.

Synergy effects or double burden?

There are major overlaps between the AI Act and the MDR. Both regulations require an effective quality management system (QMS), risk management system, technical documentation and post-market surveillance. The AI Act explicitly states that a QMS and technical documentation are sufficient.

The special requirements for high-risk AI systems should therefore be integrated into the existing processes and documentation in accordance with the MDR. The AI Act also stipulates that the conformity assessment procedure for AI medical devices is based on the MDR. This means that the notified bodies must also check conformity with the AI Act. This is intended to minimize the effort for manufacturers and avoid duplication of work.

Conclusion

Manufacturers of medical devices with AI software who want to place them on the market in the EU must comply with both the MDR and the AI Act in the future. From mid-2027, the specific requirements of the AI Act will apply to high-risk AI systems. Manufacturers should familiarize themselves with these special requirements at an early stage. This should be based on existing MDR structures and synergies should be utilized. For manufacturers, this means: act now, clarify requirements and implement appropriate processes.

Note: Christian Teichter is a lawyer at the technology law firm Schürmann Rosenthal Dreyer Rechtsanwälte and specializes in data protection and IT law.

(dmk)